linux-kernel - Re: [RFC PATCH v1 3/6] tools/nolibc: i386: Implement syscall with 6 arguments

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 20 Mar 2022 17:33:23 +0700
From:   Alviro Iskandar Setiawan <alviro.iskandar@...weeb.org>
To:     Ammar Faizi <ammarfaizi2@...weeb.org>
Cc:     Willy Tarreau <w@....eu>, "Paul E. McKenney" <paulmck@...nel.org>,
        Nugraha <richiisei@...il.com>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        "GNU/Weeb Mailing List" <gwml@...r.gnuweeb.org>, x86@...nel.org,
        llvm@...ts.linux.dev
Subject: Re: [RFC PATCH v1 3/6] tools/nolibc: i386: Implement syscall with 6 arguments

On Sun, Mar 20, 2022 at 4:37 PM Ammar Faizi wrote:
> In i386, the 6th argument of syscall goes in %ebp. However, both Clang
> and GCC cannot use %ebp in the clobber list and in the "r" constraint
> without using -fomit-frame-pointer. To make it always available for any
> kind of compilation, the below workaround is implemented.
>
> For clang (the Assembly statement can't clobber %ebp):
>   1) Save the %ebp value to the redzone area -4(%esp).
>   2) Load the 6-th argument from memory to %ebp.
>   3) Subtract the %esp by 4.
>   4) Do the syscall (int $0x80).
>   5) Pop %ebp.

I don't think you can safely use redzone from inline Assembly. The
compiler may also use redzone for a leaf function. In case the syscall
is done at the same time, your %ebp saving will clobber the redzone
that the compiler uses.

> For GCC, fortunately it has a #pragma that can force a specific function
> to be compiled with -fomit-frame-pointer, so it can always use "r"(var)
> where `var` is a variable bound to %ebp.
>
> Cc: x86@...nel.org
> Cc: llvm@...ts.linux.dev
> Signed-off-by: Ammar Faizi <ammarfaizi2@...weeb.org>
[...]
> +#if defined(__clang__)
> +static inline long ____do_syscall6(long eax, long ebx, long ecx, long edx,
> +                                  long esi, long edi, long ebp)
> +{
> +       __asm__ volatile (
> +               "movl   %%ebp, -4(%%esp)\n\t"
> +               "movl   %[arg6], %%ebp\n\t"
> +               "subl   $4, %%esp\n\t"
> +               "int    $0x80\n\t"
> +               "popl   %%ebp\n\t"
> +               : "=a"(eax)
> +               : "a"(eax), "b"(ebx), "c"(ecx), "d"(edx), "S"(esi), "D"(edi),
> +                 [arg6]"m"(ebp)
> +               : "memory", "cc"
> +       );
> +       return eax;
> +}
> +

-4(%esp) may be used by the compiler on a leaf call, you can't clobber that.

-- Viro